CVE-2021-26855

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("w3wp.exe", "powershell.exe", "cmd.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "pwsh.exe", "bash.exe")
| where InitiatingProcessFolderPath contains "Exchange Server"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessParentFileName

Splunk SPL

index=windows_events (ParentProcessName="w3wp.exe" OR ParentProcessName="powershell.exe" OR ParentProcessName="cmd.exe") (ProcessName="powershell.exe" OR ProcessName="cmd.exe" OR ProcessName="pwsh.exe" OR ProcessName="bash.exe") | search "Exchange Server" | table _time, host, ParentProcessName, ProcessName, CommandLine, ProcessPath

Sigma

title: Exchange Server RCE via CVE-2021-26855
status: experimental
description: Detects potential Remote Code Execution attempts on Microsoft Exchange Servers related to CVE-2021-26855 (ProxyLogon).
references:
    - https://securelist.com/strikeshark-campaign/120326/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26855
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
            - '\bash.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate administrative activities (requires careful tuning and whitelisting)
level: high

Elastic ES|QL

FROM process WHERE event.category == "process" AND event.type == "start" AND (process.parent.executable.endswith("w3wp.exe") OR process.parent.executable.endswith("powershell.exe") OR process.parent.executable.endswith("cmd.exe")) AND (process.executable.endswith("powershell.exe") OR process.executable.endswith("cmd.exe") OR process.executable.endswith("pwsh.exe") OR process.executable.endswith("bash.exe")) AND process.parent.executable.path LIKE "%Exchange Server%"